Two Xen Hypervisor Flaws Found With Anthropic's Claude Allow Cross-VM Memory Access

Two newly reported flaws in the Xen hypervisor, which were found using Anthropic's Claude, could let a malicious guest virtual machine read and write memory belonging to other VMs, including the privileged dom0 control domain. The reported issues affect Xen 4.6 and later, and the Qubes OS and XCP-ng virtualization platforms are also affected. Patches are available for Xen 4.17 and later, but no fixes have been released for versions 4.6 through 4.16, and no known workaround has been identified. Because a hypervisor sits beneath every guest it runs, a compromised guest that can reach memory outside its own boundary poses a serious risk to the isolation that multi-tenant cloud and virtualization environments depend on. Organizations running older Xen branches may therefore have no vendor-supplied remediation available at this time, leaving them to rely on compensating controls until a fix is issued. The disclosure also highlights the growing use of large language models such as Claude in vulnerability research, where AI-assisted analysis is being applied to low-level systems software that is difficult to audit manually. Administrators running Xen, Qubes OS, or XCP-ng should check their version numbers, apply available patches where they exist, and monitor official project channels for updates on the unpatched 4.6 to 4.16 range. Further technical details, such as exploitation conditions and affected code paths, were not included in the information available for this report.